Your Liability Cap Does Not Cover the Sales Pitch

In November 2023 a federal judge in North Carolina split a client’s lawsuit against its managed security provider into two piles. The claims about how the provider did the work were dismissed. The claims about what the provider said to win the work went forward, and the judge would not rule that the contract’s liability cap applied to them. The client says it paid $670,741.50 in fees and lost $25 million.

The same split shows up in backup, software projects, hosting and staffing. The liability cap in a managed services agreement limits what the MSP owes when it does the work badly. It does not reliably limit what the MSP owes for a false statement made to get the agreement signed. That second exposure is written by the sales team, in proposals, decks, demos and web pages, months before anyone opens the contract.

I run revenue, and I am no lawyer. What follows is an operator’s reading of public court rulings. The state-by-state questions belong with counsel.

Two piles in one lawsuit

The case is Apex Tool Group v. Cyderes and Fishtech Group, in the federal court for the Western District of North Carolina. Apex, a tool maker, hired the provider to set up and run security monitoring on a Google platform. After a ransomware attack in March 2022, Apex sued. Its complaint says the provider promised, among other things, “10 custom parsers” to pull in Apex’s data, and that the provider knew it “could not and could never perform the services they touted.” These are Apex’s allegations. No court has found them true, and I could not find how the case ended.

The order of November 9, 2023 is worth reading for how the judge sorted the claims. Negligence and gross negligence went out. When two businesses have a contract, a complaint about bad work is a contract complaint, and the customer cannot relabel it as carelessness to get around the contract’s limits. Lawyers call that the economic loss rule.

Fraudulent inducement stayed in. That is the claim that the provider made a false statement of fact to get the contract signed. A claim under North Carolina’s unfair trade practices law stayed in too, and that statute triples any damages a court awards. On the liability cap, the judge wrote that “it is premature to address the ‘limitation of liability’ provision.”

The contract ended the work claims at the first motion. The pitch claims survived it.

The same split, service line by service line

Most of the published rulings involve software vendors and large integrators. Two involve a provider an MSP owner would call a peer. The rules the judges applied do not turn on the size of the seller.

Service	Case	What was said	What the contract said	What the court did
Backup, managed IT	Mentis Sciences v. Pittsburgh Networks, New Hampshire Supreme Court, Sept. 22, 2020	A $15,864-a-year service agreement covering “data backup”	No liability for consequential damages, “including but not limited to loss of data”	The data was lost because the provider “had failed to properly back it up.” The client claimed millions. The exclusion held and the negligence claim was barred.
ERP implementation	IBM v. Lufkin Industries, Texas Supreme Court, Mar. 15, 2019	A “preconfigured system” live in “four to six months” that would “meet eighty percent” of requirements	The client “is not relying upon any representation made by or on behalf of IBM”	A jury awarded $21 million for fraudulent inducement. The court erased the award because of the non-reliance sentence and sent the contract claim back for a new trial.
Custom system build	Copart v. Sparta Consulting, federal court, Eastern District of California, 2018	Silence about a module that was not working while the client approved milestones and paid	A cap, with an exception for gross negligence or willful misconduct	The jury awarded $20.37 million for negligence and $4.69 million for fraud. The cap cut the negligence award to $9,091,568.70. It did not touch the fraud award.
Cloud software subscription	River Supply v. Oracle and NetSuite, federal court, Northern District of California, Nov. 6, 2023 and Feb. 16, 2024	First complaint: “go live quickly.” Second complaint: dated statements that the product “has the same capabilities” as the old system	An integration clause and a limitation of liability	The first complaint was dismissed as sales talk. The second went forward.
Website and e-commerce build	Purple Innovation v. Photon Interactive, federal court, Delaware, Feb. 18, 2025	“Expertise and a wealth of experience,” “industry leaders”	No representations “relied upon by either party” outside the statement of work	The fraud claim was dismissed. The clause barred it, and the statements were “non-actionable puffery.”
ERP upgrade	PC Connection v. IBM, federal court, New Hampshire, 2023	A readiness report that called the system “97% ready” with “minimal” risk	Not reached in this ruling	Negligence was dismissed. Misrepresentation claims about go-live readiness went forward.
Software sold by demo	Lineup Systems v. Lee Enterprises, Delaware Superior Court, Mar. 31, 2026	Statements in two 2021 product demos, including “Lots of very granular permissions”	An integration clause with no non-reliance language	The fraud claims went forward.
Security monitoring	Apex Tool Group v. Cyderes and Fishtech, federal court, North Carolina, Nov. 9, 2023	“10 custom parsers” and the tools to deploy them	A limitation of liability in the statement of work	Negligence was dismissed. Fraudulent inducement and the unfair practices claim went forward.

Lufkin and Copart went to a jury. Apex, River Supply, Purple, PC Connection and Lineup are early rulings on whether the claims could proceed at all, made before any evidence was heard.

What the rulings have in common

Four things repeat.

The contract holds when the complaint is about the work. In Mentis, a managed IT provider lost a client’s data by failing to back it up. The client put its losses in the millions. The agreement excluded consequential damages, “including but not limited to loss of data,” and the New Hampshire Supreme Court enforced it. The trial court had awarded $40,000. That is a liability clause doing the job it was written for.

A false statement of fact is treated as a different wrong. California’s Civil Code section 1668 says contracts that exempt anyone from responsibility for “his own fraud” are “against the policy of the law.” On April 24, 2025 the California Supreme Court held, in New England Country Foods v. VanLaw Food Products, that the section “invalidates limitations on damages for willful injury.” The same opinion says parties may still limit their liability “for pure breaches of contract.” Copart shows the two rules inside one verdict: the cap took the negligence award from $20.37 million to $9,091,568.70 and left the $4.69 million fraud award alone.

Some states then multiply the damages. North Carolina’s statute triples them. Massachusetts lets one business sue another under Chapter 93A, section 11, and sets damages for a “willful or knowing” violation at “up to three, but not less than two, times” the loss, plus attorneys’ fees. A cap written as a fixed sum was not written with a multiplier in mind.

A specific statement gets a different result than a vague one. River Supply sued twice over the same sale. Its first complaint quoted lines like “go live quickly,” and the judge called most of them “non-actionable puffery or future promises.” Its second complaint gave dates and exact words, such as “the NetSuite solution has the same capabilities as ECI Spruce to automatically revise purchase orders.” That version went forward. Puffery is the legal word for sales talk too vague to be true or false. In Purple, “industry leaders” was puffery. In PC Connection, the claims built on a “97% ready” report went forward. A number, a capability or a status report can be checked, so it can be false.

One sentence in the statement of work can decide the case. An integration clause says the document is the whole agreement. A non-reliance clause goes further: the client states that it did not rely on anything outside the document. Lufkin’s $21 million fraud award was erased by a non-reliance sentence. Purple lost its fraud claim to one in Delaware. Lee Enterprises kept its fraud claims in Delaware in March 2026 because the contract had only an integration clause, and the court held that such a clause, “absent anti-reliance language, does not preclude reliance” on what was said outside the contract. In California the River Supply contract had an integration clause that disclaimed reliance, and the judge held that it “does not preclude fraud claims that induced the contract.” Her later order added that “it is bad policy if a party can induce a contract that limits its liability by lying about its product’s capabilities.” The protection depends on the state and on the exact words.

Where an MSP makes these statements

Brad Gross, an attorney who writes contracts for MSPs, told ChannelPro in August 2023 that he calls marketing materials “Exhibit A, because that’s usually where they end up: Exhibit A on a complaint.” His example of the sentence that puts them there: “You’re going to sleep soundly at night, knowing we have you fully covered.” He was as direct about the sales floor: “salespeople, in their zeal to get the job done, will often aggrandize the ability or the scope of a service.”

Charles Weaver of MSPAlliance made the operating version of the point in August 2018: “Scope creep often comes up as an issue when sales teams make promises the services teams can’t deliver.”

No MSP survey I could find measures how often a proposal promises something the statement of work leaves out. An owner has to get that number for one company at a time. The table below is where to look. The sentences are examples of the type and are not quotes from any provider.

Service line	The sentence that sells it	What the client’s lawyer would check
Help desk	“15-minute response, 24/7”	Ticket timestamps, nights and weekends included
Backup and disaster recovery	“Your data is backed up and recoverable”	The date and result of the last restore test
Security	“Monitored around the clock”	Who reads an alert at 3 a.m., and whose contract says so
Compliance	“We make you HIPAA compliant”	Whether a provider can deliver a legal status the client owns
Cloud and migration projects	“Cut over in one weekend with no downtime”	The project plan on the day the sentence was written
Hosting	“99.99 percent uptime”	The outage log, next to the credit the contract pays
Staffing	“A dedicated, certified engineer”	The name, the certificate and the hours
Pricing	“All-inclusive, unlimited support”	The exclusions list in the managed services agreement

Every row has a number, a capability or a status in it.

The federal government already collects on this gap when it is the client. In March 2023 a web design and hosting firm, Jelly Bean Communications Design, paid $293,771 after the Justice Department alleged that, “contrary to its representations in agreements and invoices,” it “did not provide secure hosting” for a Florida children’s health insurance site. In July 2025 Hill ASC, a Maryland IT services firm, agreed to pay at least $14.75 million. The allegations included billing for “information technology personnel who did not have the experience or education required under the contract.” Both settlements resolved allegations with no finding of liability, and the False Claims Act reaches only government money. The pattern is the one in the table: hosting in one case, staffing in the other.

An MSP that rents its security operations center, its backup platform or its cloud from a vendor is repeating that vendor’s promise under its own name. Gross’s rule for that is one sentence: “You as an MSP should not be offering or making marketing claims that your upstream providers aren’t willing to make.”

The insurance has the same split

Errors and omissions insurance is the policy an MSP buys for client claims. One carrier’s form shows how the same promise can sit on both sides of the coverage line. The technology E&O form from Philadelphia Insurance Companies lists, among the incidents it covers, “Breach of warranties or representations relating to fitness, quality, suitability or performance.” An exclusion in the same form removes claims arising from the breach “of any guarantee or warranty including any express warranty or representation.” A second exclusion removes any “dishonest, fraudulent, criminal or malicious act.” This is one carrier’s form, and other forms differ. The wording decides whether a claim about an oversold promise gets a defense.

The application for that policy asks, “Do you require the use of a written contract or agreement for all engagements?” It also asks whether, in the past five years, any customers “withheld payment or requested a refund of fees” because the service “did not meet customer’s performance expectations.” The underwriter wants that history before it prices the policy. An MSP’s credit memos hold the same information, and they are already in the accounting system.

What a buyer inherits

In a stock purchase the company keeps its legal identity, so everything it ever told a client comes with it. In an asset purchase the buyer takes the client contracts assigned to it, and a 2018 review in the American Bar Association’s Business Law Today lists four situations in which the buyer takes the seller’s other liabilities too, including when it “expressly or impliedly assumes” them.

The paper in an acquired MSP can be thin. Christopher Vollmond-Carstens, chief M&A officer at Ntiva, told MSP Success about a target whose clients “didn’t really have contracts in place.” Ntiva “paused that particular acquisition effort for 6 to 8 months” so the seller could get agreements signed with “at least the top 20, top 30” clients.

A client with no signed agreement has no cap and no non-reliance sentence. For that client, what the founder said is the whole deal.

Seven checks before the next operating review

1. Pull every proposal, sales deck and web page from the last 24 months. Mark each number, capability and status claim. Next to each one, write the name of the person who can prove it today.
2. Put each marked claim beside the signed statement of work and the service catalog. A claim that appears in the proposal and not in the statement of work is the gap.
3. Ask counsel one question for each state you sell in: does our agreement have a non-reliance sentence, and does a court in this state enforce it? An integration clause alone lost in Delaware in March 2026.
4. Build proposals from the service catalog. Any sentence that is not in the catalog needs sign-off from one person outside sales before it goes to a client.
5. Cut every claim an upstream vendor will not put in writing.
6. Run checks 1 and 2 on each acquired company’s top 20 to 30 clients, and count the clients with no signed agreement at all.
7. Read the warranty exclusion in the E&O policy. Ask the broker, in writing, whether a misrepresentation claim would be defended. Then total last year’s credits and refunds for unmet expectations.

The first check can start with one deal. Take the largest contract the sales team closed last quarter. Read the proposal next to the signed statement of work, and count the sentences that appear in the first and not in the second. The cap was written for the second document. Which clause in your agreement covers the first?